{"id":"EUVD-2026-16064","enisaUuid":"1c0ea33c-5830-376e-90ac-66a955d23c2c","description":"LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, the `replace_first` filter in LiquidJS uses JavaScript\u0027s `String.prototype.replace()` which interprets `$\u0026` as a back reference to the matched substring. The filter only charges `memoryLimit` for the input string length, not the amplified output. An attacker can achieve exponential memory amplification (up to 625,000:1) while staying within the `memoryLimit` budget, leading to denial of service. Version 10.25.1 patches the issue.","datePublished":"Mar 26, 2026, 12:33:20 AM","dateUpdated":"Mar 26, 2026, 3:02:26 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/harttle/liquidjs/security/advisories/GHSA-6q5m-63h6-5x4v\nhttps://github.com/harttle/liquidjs/commit/35d523026345d80458df24c72e653db78b5d061d\n","aliases":"CVE-2026-33287\nGHSA-6q5m-63h6-5x4v\n","assigner":"GitHub_M","epss":0.48,"enisaIdProduct":[{"id":"792ae265-32b7-33cd-aeed-ef97d65ea693","product":{"name":"liquidjs","vendor":{"name":"harttle"}},"product_version":"\u003c 10.25.1"}],"enisaIdVendor":[{"id":"ecfe36ff-8d20-3335-b135-89cef121778a","vendor":{"name":"harttle"}}],"enisaIdVulnerability":[{"id":"aaab04ff-123f-31a1-828b-79f15e24ac6f","vulnerability":{"id":"CVE-2026-33287","description":"LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, the `replace_first` filter in LiquidJS uses JavaScript\u0027s `String.prototype.replace()` which interprets `$\u0026` as a back reference to the matched substring. The filter only charges `memoryLimit` for the input string length, not the amplified output. An attacker can achieve exponential memory amplification (up to 625,000:1) while staying within the `memoryLimit` budget, leading to denial of service. Version 10.25.1 patches the issue.","datePublished":"Mar 26, 2026, 12:33:20 AM","dateUpdated":"Mar 26, 2026, 3:02:26 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/harttle/liquidjs/security/advisories/GHSA-6q5m-63h6-5x4v\nhttps://github.com/harttle/liquidjs/commit/35d523026345d80458df24c72e653db78b5d061d\n","enisa_id":"EUVD-2026-16064\n","assigner":"GitHub_M","epss":0.48,"dataProcessed":"Nov 3, 2026, 7:18:07 AM","vulnerabilityProduct":[{"id":"f0644bf1-6d75-3b0b-8017-e71267f07977","product":{"name":"liquidjs","vendor":{"name":"harttle"}},"product_version":"\u003c 10.25.1"}],"vulnerabilityVendor":[{"id":"9aee75d3-c273-324f-9582-856feaf2ad0d","vendor":{"name":"harttle"}}]}},{"id":"f2c8ff1b-a204-39ad-b317-09a0bef738cd","vulnerability":{"id":"GHSA-6q5m-63h6-5x4v","description":"LiquidJS has Exponential Memory Amplification through its replace_first Filter $\u0026 Pattern","datePublished":"Mar 25, 2026, 5:44:23 PM","dateUpdated":"Oct 29, 2026, 5:28:57 PM","baseScore":0.0,"references":"https://github.com/harttle/liquidjs/security/advisories/GHSA-6q5m-63h6-5x4v\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-33287\nhttps://github.com/harttle/liquidjs/commit/35d523026345d80458df24c72e653db78b5d061d\nhttps://github.com/harttle/liquidjs\nhttps://github.com/harttle/liquidjs/blob/v10.25.1/CHANGELOG.md\nhttps://github.com/harttle/liquidjs/releases/tag/v10.25.1\n","enisa_id":"EUVD-2026-16064\n","aliases":"GHSA-6q5m-63h6-5x4v\nCVE-2026-33287\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:58:58 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}